This Week in SaaS: France Flips the E-Invoicing Switch, Google Wraps Its Spam Update, and a Critical VPN Patch Lands
Compliance deadlines, not shiny AI demos, drove the week’s biggest SaaS news this week. France switched on its long-delayed e-invoicing mandate, Google finished retuning its spam filter, and Microsoft shipped an emergency-grade fix for VPN infrastructure. Here’s what founders and IT managers actually need to act on.
💳 Finance & Invoicing
France’s B2B e-invoicing mandate goes live
France’s continuous transaction controls regime went live on September 1, 2026, after years of postponements — and this time the tax authority (DGFiP) has confirmed there will be no further delays. Every VAT-registered French business must now be able to receive electronic invoices, while large and intermediate companies must also issue them and report invoice data in near-real time. Invoices flow in Factur-X, UBL, or CII formats through government-approved platforms. There is a grace period worth noting — no penalties apply during 2026 — but “able to receive” is now the baseline, not a roadmap item. If you sell into France, check your billing stack this week.
QuickBooks adds AI agents — and raises prices
Intuit spent late summer bolting conversational AI onto QuickBooks Online, and the changes hardened into general availability heading into fall. New capabilities include quote-to-cash workflows, deeper payroll queries, and lending insights via QuickBooks Capital — the pitch being that owners can now take actions through chat, not just read reports. The catch: the AI push arrives alongside a fresh round of price increases. For small teams already on QBO, the math is worth redoing before renewal, because you may be paying more for features you won’t use.
FreshBooks leans into instant payouts
FreshBooks’ 2026 update cycle is unusually payment-centric rather than AI-centric. Its headline addition, Instant Payouts, lets eligible users pull payment funds on nights, weekends, and holidays instead of waiting for the standard settlement window. It is a small feature with an outsized cash-flow impact for freelancers and micro-agencies who live invoice-to-invoice. Worth verifying eligibility and per-transaction fees on the FreshBooks site before relying on it.
📊 Marketing & SEO
Google’s August spam update finishes rolling out
Google’s August 2026 spam update completed on August 21 after roughly two days and sixteen hours, and its effects are still settling into rankings this month. Spam updates target sites and tactics that violate Google’s policies rather than general content quality, so the pages hit hardest tend to be those leaning on scaled or manipulative content. If your traffic dipped in late August, this — not a core update, which Google has not announced — is the likely cause. Recovery means cleaning up the flagged behaviour, not chasing new ranking tricks.
Google Ads starts auto-migrating campaigns to AI Max
Starting September 1, Google began automatically migrating campaign-level Broad Match and legacy Automatically Created Assets campaigns into AI Max, its bundle of AI-driven targeting and creative features. For advertisers, the default is now “on” — meaning if you don’t review your settings, Google’s automation will increasingly decide where and how your ads show. That is fine for teams that trust the black box and risky for those with tight brand or geo controls. Audit your campaigns before the migration reaches them.
Klaviyo opens up to AI agents
Klaviyo shipped a wave of autonomous-marketing features, including Composer (campaigns from a prompt), a Customer Agent for support, and send-time optimization. The more strategic move: it exposed 260 MCP tools and 490 APIs so external AI agents can operate the platform directly, plus natural-language SQL inside its data platform. It is one of the clearest bets yet that the next marketing interface is an agent talking to your stack — not a human clicking through dashboards.
🔐 Cybersecurity & VPN
Microsoft patches critical VPN flaws on Patch Tuesday
Microsoft’s September 2026 security updates addressed eight CVEs in Windows Server Routing and Remote Access (RRAS) and VPN protocols including SSTP and IKEv2 — four rated Critical, with the worst carrying a CVSS score of 9.8. Anything at 9.8 is effectively “patch now”: these are the remote-code-execution class of bugs attackers weaponise fastest. If you run RRAS or terminate VPN connections on Windows Server, this update is not optional and should not wait for the next maintenance window.
Read more → Richard M. Hicks Consulting
McKesson discloses a data breach
Healthcare-supply giant McKesson disclosed a cybersecurity incident discovered on August 25, involving unauthorized access to third-party applications and data exfiltration, later narrowed to a subset of customers in its oncology and medical-surgical units. It is another reminder that the third-party and supply-chain layer remains the softest target — the breach came through connected applications, not McKesson’s core systems. Vendor-risk reviews and tighter scoping of app integrations are the practical takeaways.
Proton VPN ships stability and extension updates
On the consumer side, Proton VPN pushed a round of updates: its Android app improved ProTUN stability and raised its build target to Android 16, while the browser extension fixed server-list loading, connection-token refreshes, and split-tunneling reliability. None of it is headline-grabbing, but for a privacy tool, boring reliability work is exactly what you want to see shipping regularly. Update your clients to pick up the fixes.
What to watch next week
With France’s mandate now live, expect other EU states to firm up their own timelines — and expect fallout reports from Google’s spam update to keep surfacing as rankings stabilise. On the security side, patch cadence is the story: 9.8-rated VPN bugs rarely stay unexploited for long.